PcVue MQTT Add-On Improper Certificate Validation Vulnerability

A vulnerability exists in the MQTT add-on of PcVue due to improper validation of remote device certificates. The add-on fails to check whether a certificate has expired or is not yet valid, allowing malicious devices to present certificates that are not properly rejected. While the issue can be mitigated by using client certificates, the flaw still poses a risk for devices that do not use them.

Impact

Exploitation of this vulnerability could lead to unauthorized devices being accepted in the MQTT communication, potentially allowing them to interfere with the application or system.

Remediation

Users can upgrade to PcVue versions 16.2.5 or 16.3.0 to address this vulnerability. For PcVue 15 users, the fix is planned in version 15.2.12.